diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 000000000..34aa9cab8
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,174 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  SQLX_OFFLINE: "true"
+  CARGO_TERM_COLOR: always
+  SCCACHE_BUCKET: ${{ secrets.SCCACHE_BUCKET }}
+  SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_ENDPOINT }}
+  SCCACHE_S3_USE_SSL: "true"
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  RUSTC_WRAPPER: /usr/local/bin/sccache
+  REGISTRY: rg.nl-ams.scw.cloud/foxhunt
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Job 1: cargo check + clippy
+  # ---------------------------------------------------------------------------
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Install sccache
+        run: |
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.8.1/sccache-v0.8.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin sccache-v0.8.1-x86_64-unknown-linux-musl/sccache
+          chmod +x /usr/local/bin/sccache
+
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: cargo check
+        run: cargo check --workspace
+
+      - name: cargo clippy
+        run: cargo clippy --workspace -- -D warnings
+
+  # ---------------------------------------------------------------------------
+  # Job 2: tests
+  # ---------------------------------------------------------------------------
+  test:
+    needs: check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install sccache
+        run: |
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.8.1/sccache-v0.8.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin sccache-v0.8.1-x86_64-unknown-linux-musl/sccache
+          chmod +x /usr/local/bin/sccache
+
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: cargo test
+        run: cargo test --workspace --lib
+
+  # ---------------------------------------------------------------------------
+  # Job 3: Build + push service images (main only)
+  # ---------------------------------------------------------------------------
+  build-images:
+    needs: test
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        service:
+          - trading_service
+          - api_gateway
+          - broker_gateway_service
+          - ml_training_service
+          - backtesting_service
+          - trading_agent_service
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to Scaleway Container Registry
+        run: |
+          echo "${{ secrets.SCW_SECRET_KEY }}" | docker login rg.nl-ams.scw.cloud -u nologin --password-stdin
+
+      - name: Build ${{ matrix.service }}
+        run: |
+          docker build \
+            --build-arg SERVICE=${{ matrix.service }} \
+            --build-arg SCCACHE_BUCKET=${{ secrets.SCCACHE_BUCKET }} \
+            --build-arg AWS_ACCESS_KEY_ID=${{ secrets.SCW_ACCESS_KEY }} \
+            --build-arg AWS_SECRET_ACCESS_KEY=${{ secrets.SCW_SECRET_KEY }} \
+            --build-arg SCCACHE_ENDPOINT=${{ secrets.SCCACHE_ENDPOINT }} \
+            -f infra/docker/Dockerfile.service \
+            -t ${{ env.REGISTRY }}/${{ matrix.service }}:${{ github.sha }} \
+            -t ${{ env.REGISTRY }}/${{ matrix.service }}:latest \
+            .
+
+      - name: Push ${{ matrix.service }}
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ matrix.service }}:${{ github.sha }}
+          docker push ${{ env.REGISTRY }}/${{ matrix.service }}:latest
+
+  # ---------------------------------------------------------------------------
+  # Job 4: Build + push web-gateway image (main only)
+  # ---------------------------------------------------------------------------
+  build-web-gateway:
+    needs: test
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to Scaleway Container Registry
+        run: |
+          echo "${{ secrets.SCW_SECRET_KEY }}" | docker login rg.nl-ams.scw.cloud -u nologin --password-stdin
+
+      - name: Build web-gateway
+        run: |
+          docker build \
+            -f infra/docker/Dockerfile.web-gateway \
+            -t ${{ env.REGISTRY }}/web-gateway:${{ github.sha }} \
+            -t ${{ env.REGISTRY }}/web-gateway:latest \
+            .
+
+      - name: Push web-gateway
+        run: |
+          docker push ${{ env.REGISTRY }}/web-gateway:${{ github.sha }}
+          docker push ${{ env.REGISTRY }}/web-gateway:latest
+
+  # ---------------------------------------------------------------------------
+  # Job 5: Deploy to Kapsule (main only, after all images built)
+  # ---------------------------------------------------------------------------
+  deploy:
+    needs: [build-images, build-web-gateway]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+            -o /usr/local/bin/kubectl
+          chmod +x /usr/local/bin/kubectl
+
+      - name: Configure kubeconfig
+        run: |
+          mkdir -p ~/.kube
+          echo "${{ secrets.KUBECONFIG }}" | base64 -d > ~/.kube/config
+          chmod 600 ~/.kube/config
+
+      - name: Update deployments
+        run: |
+          for svc in trading-service api-gateway broker-gateway-service ml-training-service backtesting-service trading-agent-service; do
+            kubectl -n foxhunt set image deployment/${svc} ${svc}=${{ env.REGISTRY }}/${svc}:${{ github.sha }} || true
+          done
+          kubectl -n foxhunt set image deployment/web-gateway web-gateway=${{ env.REGISTRY }}/web-gateway:${{ github.sha }} || true
+
+      - name: Wait for rollouts
+        run: |
+          for svc in trading-service api-gateway broker-gateway-service ml-training-service backtesting-service trading-agent-service web-gateway; do
+            kubectl -n foxhunt rollout status deployment/${svc} --timeout=300s || true
+          done